CVE-2025-54116 Overview
CVE-2025-54116 is an improper access control vulnerability [CWE-284] in Windows MultiPoint Services. An authorized local attacker can exploit this weakness to elevate privileges on affected Windows and Windows Server systems. The flaw requires local access, low privileges, and user interaction to succeed. Microsoft rated the issue with a CVSS 3.1 score of 7.3.
The vulnerability affects a broad range of Windows client and server versions, from Windows 10 1507 through Windows 11 24H2, and Windows Server 2016 through Windows Server 2025. Successful exploitation grants high impact to confidentiality, integrity, and availability on the target host.
Critical Impact
Local privilege escalation on affected Windows and Windows Server systems running MultiPoint Services, resulting in full compromise of the host.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-09-09 - CVE CVE-2025-54116 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54116
Vulnerability Analysis
The vulnerability resides in Windows MultiPoint Services, a role that allows multiple users to share a single Windows host through separate stations. Improper access control checks in the service enable a local, authenticated user to perform actions reserved for higher-privileged principals. The flaw is classified under [CWE-284] Improper Access Control.
Exploitation results in privilege escalation on the local machine. Because MultiPoint Services runs privileged operations on behalf of station users, missing or incorrect authorization checks allow an attacker with a valid low-privileged account to break out of the intended security boundary. The impact covers confidentiality, integrity, and availability at the host level.
Root Cause
Microsoft has not published a detailed technical write-up. Based on the CWE-284 classification and MSRC advisory, the root cause is missing or insufficient authorization checks within a Windows MultiPoint Services component. The service exposes functionality to logged-on station users without adequately validating that the caller is entitled to perform the requested privileged operation.
Attack Vector
The attack vector is local. An attacker must already possess valid credentials on the target system and execute code interactively or via a session on a host with the MultiPoint Services role installed. User interaction is required, which typically indicates the attacker must coerce or wait for another user to perform an action, or trigger the flaw during an interactive session. On success, the attacker gains elevated privileges on the host.
No public proof-of-concept or exploit code is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.524% (percentile 41.7) as of 2026-08-11.
See the Microsoft Security Update CVE-2025-54116 advisory for vendor-supplied technical details.
Detection Methods for CVE-2025-54116
Indicators of Compromise
- Unexpected child processes spawned by MultiPoint Services binaries (for example, wmsservice.exe, wmsmanager.exe) running with SYSTEM privileges.
- Creation of new local administrator accounts or additions to privileged groups on hosts running the MultiPoint Services role.
- Anomalous access to protected registry keys or files immediately following an interactive station logon.
Detection Strategies
- Inventory Windows systems with the MultiPoint Services role enabled and prioritize monitoring on those hosts.
- Correlate low-privileged station logons with subsequent process creation events showing elevated integrity levels.
- Alert on token manipulation and privilege assignment events (Windows Event IDs 4672, 4673, 4674) originating from MultiPoint sessions.
Monitoring Recommendations
- Enable process creation auditing with command-line logging and Sysmon Event ID 1 on MultiPoint hosts.
- Forward Windows Security and MultiPoint operational logs to a centralized SIEM for correlation.
- Track membership changes for Administrators, Remote Desktop Users, and MultiPoint management groups.
How to Mitigate CVE-2025-54116
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-54116 to all affected Windows client and server versions.
- Identify hosts running the MultiPoint Services role and prioritize them in the patch cycle.
- Restrict interactive logon rights on MultiPoint hosts to the minimum set of required users.
Patch Information
Microsoft has published a security update for CVE-2025-54116 through the MSRC update guide. Administrators should deploy the appropriate cumulative update for each affected Windows 10, Windows 11, and Windows Server version listed in the advisory. Verify installation using Get-HotFix or the Update History panel after deployment.
Workarounds
- If patching is delayed, remove or disable the MultiPoint Services role on hosts where it is not required.
- Enforce least privilege for accounts that log on to MultiPoint stations and remove unnecessary local group memberships.
- Restrict physical and remote access to MultiPoint hosts to trusted users only.
# Check for the MultiPoint Services role on a Windows Server host
Get-WindowsFeature -Name MultiPoint-Connector, MultiPointServerRole
# Remove the MultiPoint Services role if not required (requires reboot)
Uninstall-WindowsFeature -Name MultiPointServerRole -Restart
# Verify installed security updates after patching
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
